AZ-500 Manage identity and access Practice Test 6 — 15 Questions

Question 1

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks (Azure Logic Apps) are the correct automation feature because they allow you to define a workflow that triggers on an Azure Sentinel alert or incident, such as when a Key Vault firewall is disabled. This workflow can include sending an email to the on-call security engineer via connectors like Office 365 Outlook. Automation rules can trigger playbooks but cannot directly send emails or perform complex actions; they rely on playbooks for such tasks.

Answer

Automation rules

Answer

Scheduled analytics rules

Answer

Livestream

Question 2

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage

Question 3

A security operations team uses Microsoft Sentinel to centralize security monitoring across their hybrid environment. They need to ingest AWS CloudTrail logs from an Amazon Web Services account to detect suspicious activities in their AWS environment. Which data connector should they configure in Microsoft Sentinel?

Accepted Answer

AWS CloudTrail connector. The AWS CloudTrail connector is the correct data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel. It requires configuring an S3 bucket in AWS to receive CloudTrail logs and then connecting that bucket to Sentinel via the connector, enabling the detection of suspicious activities such as unauthorized API calls or privilege escalations in the AWS environment.

Answer

Azure Activity log connector

Answer

Syslog connector

Answer

Common Event Format (CEF) connector

Question 4

A security team uses Microsoft Sentinel. They want to create a custom analytics rule that generates an incident whenever a user from a list of known malicious IP addresses attempts to sign in to any Azure AD app. They have imported the IP list into Sentinel using Threat Intelligence. Which rule type should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to run a KQL query at a defined interval (e.g., every 5 minutes) to match sign-in events from IP addresses in a Threat Intelligence indicator. This rule type supports alert grouping and incident creation based on the query results, making it ideal for correlating Azure AD sign-in logs with a known malicious IP list imported via Threat Intelligence.

Answer

Near-real-time (NRT) rule

Answer

Microsoft Security rule

Answer

Anomaly rule

Question 5

A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the severity and owner fields.. Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.

Answer

Modify the analytics rule to include a custom script that runs upon alert generation.

Answer

Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

Answer

Configure a workbook to filter and manually assign incidents.

Question 6

A security analyst is using Microsoft Sentinel to detect multi-stage attacks. They want to create an analytics rule that correlates a user sign-in from an unusual location with a subsequent data exfiltration attempt from Azure Blob Storage within one hour. Which type of analytics rule should they use?

Accepted Answer

Scheduled query rule with entity mapping.. A scheduled query rule with entity mapping is correct because it allows the security analyst to write a KQL query that correlates two distinct events—a sign-in from an unusual location and a subsequent data exfiltration from Azure Blob Storage—within a defined time window (one hour). Entity mapping enables the rule to link these events by common entities (e.g., user account or IP address), which is essential for detecting multi-stage attacks. This rule type runs on a schedule, making it ideal for time-bound correlation queries.

Answer

Fusion rule.

Answer

Microsoft Security incident rule.

Answer

Anomaly rule.

Question 7

A company wants to use Microsoft Defender for Cloud to continuously assess their Azure resources against the Microsoft cloud security benchmark (MCSB). They need to view the current compliance score and specific recommendations for failing controls. Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess resources against compliance standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score, a breakdown of failing controls, and actionable recommendations to remediate those controls, directly meeting the company's requirement.

Answer

Security Policy

Answer

Secure Score

Answer

Workload Protections

Question 8

A company uses Microsoft Defender for Cloud to protect their Azure virtual machines. They have enabled the integrated vulnerability assessment (VA) solution on all VMs. The security team wants to receive an alert when a VM is found to have a vulnerability rated as 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated vulnerability assessment (VA) solution powered by Qualys, which provides continuous scanning and alerts for critical vulnerabilities. Plan 1 only offers basic threat detection and does not include the VA solution or the ability to generate alerts based on vulnerability severity ratings.

Answer

Defender for Servers Plan 1

Answer

Defender for SQL

Answer

Defender for App Service

Question 9

An organization is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). They use Microsoft Defender for Cloud to manage their Azure security posture. Which feature in Defender for Cloud should they use to view their current compliance status against HIPAA controls?

Accepted Answer

Regulatory compliance dashboard.. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your compliance posture against various standards, including HIPAA. It continuously assesses your Azure environment against HIPAA controls and displays the current compliance status, enabling you to track and improve adherence to regulatory requirements.

Answer

Security posture dashboard.

Answer

Recommendations dashboard.

Answer

Inventory dashboard.

Question 10

A security team uses Microsoft Sentinel. They have created a playbook in Azure Logic Apps that automatically isolates a compromised VM by modifying a network security group. They want the playbook to run automatically whenever an incident of type 'VM Isolation' is created. Which Microsoft Sentinel feature should they use to trigger the playbook automatically?

Accepted Answer

Automation rules.. Automation rules in Microsoft Sentinel are designed to trigger automated responses, such as running a playbook, when an incident is created or updated. In this scenario, the rule can be configured to match incidents of type 'VM Isolation' and automatically execute the Logic Apps playbook to isolate the compromised VM. This is the correct feature for incident-triggered automation without requiring a separate analytics rule.

Answer

Scheduled analytics rules.

Answer

Fusion rules.

Answer

Workbooks.

Question 11

A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?

Accepted Answer

Enable 'Create incident from alerts triggered by this rule' in the Incident settings. Option A is correct because the 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.

Answer

Configure the 'Alert details' section with the appropriate severity and description

Answer

Define entity mapping in the 'Entity mapping' tab

Answer

Connect Azure Activity log to Sentinel via Event Hub

Question 12

A security analyst uses Microsoft Defender for Cloud. They need to automatically apply a specific remediation action (e.g., enable audit logging) to a set of Azure SQL servers that are found to be non-compliant with a security policy. Which Defender for Cloud feature should they use?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.

Answer

Continuous export

Answer

Alert suppression rules

Answer

Regulatory compliance dashboard

Question 13

A company uses Microsoft Defender for Cloud. They want to automatically apply a security recommendation (such as enabling encryption on storage accounts) to all existing resources that are found to be non-compliant without manual intervention. Which Defender for Cloud feature should they configure?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger automated actions (e.g., Azure Logic Apps) based on security recommendations or regulatory compliance changes. By configuring a workflow automation rule that triggers on the 'recommendation' event for a specific recommendation (like 'Storage accounts should use customer-managed key for encryption'), you can automatically remediate non-compliant resources without manual intervention, for example by invoking a Logic App that enables encryption on the storage account.

Answer

Continuous export

Answer

Email notifications

Answer

Security policies

Question 14

A company uses Microsoft Defender for Cloud. The security team wants to receive a weekly email digest that includes the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. Which Defender for Cloud feature should they configure?

Accepted Answer

Email notifications for alerts and weekly digests. Option C is correct because Microsoft Defender for Cloud provides a built-in 'Email notifications for alerts and weekly digests' feature that allows security teams to configure a weekly email containing the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. This feature is specifically designed to deliver a summary of the security posture directly to recipients without requiring manual export or custom automation.

Answer

Regulatory Compliance dashboard

Answer

Security policies

Answer

Continuous Export

Question 15

A security analyst uses Microsoft Sentinel. They have created a playbook that tags Azure VMs as 'isolated' when a high-severity malware alert is triggered. They want this playbook to run automatically whenever a related alert is generated. Which feature should they configure?

Accepted Answer

Automation rule.. Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when specific alerts or incidents are created. In this scenario, the playbook tags Azure VMs as 'isolated' upon a high-severity malware alert, and an automation rule can be configured to run that playbook automatically whenever such an alert is generated, without manual intervention.

Answer

Scheduled analytics rule.

Answer

Incident creation rule.

Answer

Workbook.